A researcher published 30+ N-central zero-days; N-able took hosted servers offline and shipped 2026.4 HF2 for 7 CVEs. Exploitation attempts against honeypots followed.
What to do: Nov 12: Escalation: researcher released two more exploit sets ("4EverAble2Shell", "Agent2Shell") that work against the hotfix; exploited within hours; 21 N-able servers breached, 19 of them fully patched; XMRig miners deployed. N-able advises disabling the Legacy API.
N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
🚨 UPDATE: Exploitation attempts targeting N-able N-central honeypots have been observed following the public disclosure of 30+ #Able2Shell vulnerabilities. Security firm watchTowr reports overnight activity and urges users to check for signs of compromise and
🚨 UPDATE: N-able releases N-central 2026.4 HF2 to address 7 CVEs following the Able2Shell disclosure. All hosted N-central servers worldwide have been upgraded. On-premises customers are urged to keep servers offline until updates are applied. Another hotfix
🧵 The researcher behind Able2Shell published two more sets of exploit code for N-able N-central, stating that both work against the recent hotfix. Read our updated blog for details about "4EverAble2Shell" and "Agent2Shell":
‼️ BREAKING: Recently patched N-central servers remain exploitable under certain conditions. "4EverAble2Shell" enables unauthenticated root RCE; "Agent2Shell" can run Windows SYSTEM commands with the appliance ID. Attackers are probing. N-able is investigati
Hackers Target N-central Zero-Days as N-able Rushes Patches
Why this score
Plan rubric with caps (verified sweep, Nov 11)